A critical security vulnerability affecting Coldcard hardware wallet models MK3, MK4, MK5, and Q is being actively exploited, with approximately 1,000 BTC observed moving on-chain in connection with the issue. Coldcard, manufactured by Coinkite, is one of the most widely used Bitcoin-only hardware wallets, favored by self-custody advocates for its air-gapped design and support for advanced features like multisig and PSBT (Partially Signed Bitcoin Transactions). Bitcoin Magazine reports that Coinkite has issued an official announcement addressing the matter.

The Vulnerability

The bug allows attackers to recover seed phrases without any interaction from the wallet owner. Coldcard wallets that generated seed phrases using the device's internal random number generator—rather than the recommended 50+ dice rolls for user-supplied entropy—are affected. Specifically, any word seed generated after the end of 2020 without the dice roll method is considered insecure, as it was created without sufficient randomness and can be brute-forced by a malicious attacker.

The root issue is a failure to produce sufficient entropy—the randomness that makes a seed phrase computationally infeasible to guess. A properly generated 12-word seed has 128 bits of entropy; a 24-word seed has 256 bits. When entropy is insufficient, the space of possible seeds shrinks dramatically, making brute-force reconstruction practical. This class of vulnerability has affected other cryptocurrency systems in the past, and it is particularly severe because it silently undermines the security assumption that seed phrases are unguessable.

Only wallets generated using the dice roll method, with a minimum of 50 rolls, are considered safe from this vulnerability.

The issue extends beyond primary seed phrases. It also affects ephemeral keys and session keys used in the Clone Coldcard and Key Teleport features, as well as BIP 85 seeds derived from a compromised seed. BIP 85 allows a single master seed to deterministically derive multiple child seeds; if the parent is compromised, every derived child seed inherits that weakness.

Immediate Steps Required

All affected users must move their funds to a new, securely generated seed. Several options are available depending on the user's circumstances:

Option 1: Use a Different Hardware Wallet

If you have access to a non-Coldcard hardware wallet, transferring funds there is the quickest and most straightforward path to security.

Option 2: Generate a Passphrase on Coldcard

If a Coldcard is your only hardware wallet, generate a passphrase using a minimum of six seed words selected from the BIP 39 word list. Users should consult this guide to select words and should not choose them manually. After creating the passphrase, verify the wallet fingerprint or an address, power down the device, restart it, re-enter the passphrase, and confirm that the fingerprint or address matches before sending funds. This is a temporary measure intended to prevent brute-force attacks over a period of days, buying time to generate a fully new seed. The passphrase must be written down securely.

Option 3: Use a Software Wallet

For users with no other options or those uncomfortable using the device at all, the Nunchuck wallet—available on both mobile and desktop—is recommended. Users should take care to complete and verify all backups before transferring funds. Nunchuck supports multisig setups for those managing significant sums, which can be configured across multiple devices. Blockstream Green and Bluewallet are two additional software wallet alternatives.

Firmware Update Available

Coinkite has released a firmware update addressing the vulnerability. Any word seed generated after applying this update should be secure. The dice roll entropy option also remains available. Coldcard devices remain safe to use as long as the seed is generated securely—either through the patched firmware or the dice roll method.

Users who have moved funds to a hot wallet or less secure temporary storage can safely return to using their Coldcard after applying the firmware update and generating a new seed.

Community Awareness

The article's author, Shinobi, urges those who have secured their own funds to proactively reach out to anyone they know who may be using a vulnerable Coldcard. Many Bitcoin users do not follow news regularly and may be unaware that they are at risk. The scale of the observed exploit—approximately 1,000 BTC—underscores that attackers are actively scanning the blockchain for vulnerable wallets, making timely action essential.

This article first appeared on Bitcoin Magazine.